Smart Memory Query

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:01 AM UTC
• Version: 1.0.0

Overview

This skill is transparent about what it does, but it would automatically search persistent agent memory far more often than most users would expect.

Install only if you are comfortable with the agent proactively searching stored memory on most tasks and on mentions of names, services, tools, or projects. Users handling sensitive or compartmentalized work should prefer a narrower memory skill that searches only when prior context is explicitly relevant or requested.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:2
• Finding: Compulsory Broad Access to Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 2-24 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown name: smart-memory-query description: "Enforce proactive, query-optimized memory_search usage. Must run memory_search when (1) prior context is referenced, (2) a new task starts, or (3) a proper noun appears. Build short 2–4 token queries by splitting intent to avoid empty AND-based FTS results." always: true --- # Smart Memory Query ## Trigger: run `memory_search` when any of these apply - **T1 Prior context**: user references previous decisions, agreements, or history (e.g., “we decided this before”). - **T2 New task**: before starting a new topic/task, check prior preferences/decisions. - **T3 Proper noun**: project, tool, service, or person name appears. If unsure, search. Missed context costs more than one extra search. If multiple triggers fire, run separate searches per trigger. ## Query-building rules (required) 1. **Split intent** — break search intent into 2–3 independent angles. Do not overpack one query. 2. **Extract core tokens** — keep only 2–3 key nouns per angle; prioritize proper nouns. 3. **Run multi-query** — call `memory_search` per angle, with **2–4 tokens per query**. 4. **Merge results** — if all are empty, retry once with a single key proper noun. ``` ### Technical Analysis The skill is globally enabled through `always: true` and instructs the agent to access persistent memory whenever a new task begins or any proper noun appears. These triggers are substantially broader than situations in which historical context is necessary. The policy also requires multiple independent searches and an additional retry when no results are found. This expands the scope of memory inspection beyond the immediate task and violates least-privilege principles. The skill contains no requirement for user consent, task-specific authorization, sen ...[truncated 1673 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `always: true` so the policy is not automatically applied to every interaction. 2. Restrict `memory_search` to explicit references to prior context or cases where historical information is demonstrably necessary to fulfill the request. 3. Do not treat every new task or proper noun as sufficient authorization to inspect persistent memory. 4. Ask for user consent before performing broad or potentially sensitive historical searches. 5. Use one narrowly scoped query by default and expand only when the user requests a broader search or when the initial result establishes clear relevance. 6. Add sensitivity controls that exclude credentials, personal information, private communications, and unrelated project records. 7. Prevent unrelated search results from entering responses or influencing task execution. 8. Record the reason and scope for each memory query to support auditing and detection of excessive access. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill is configured with `always: true` and broad triggers such as any new task or any proper noun, which makes it activate on a large fraction of normal conversations. This can cause unnecessary memory lookups, expanding access to prior user context even when not needed and increasing the chance of privacy over-collection, prompt steering, or degraded agent behavior through excessive tool use.

Static analysis

Detected: suspicious.privileged_always

Skill is configured with always=true (persistent invocation).

Warn

• Code: suspicious.privileged_always
• Location: SKILL.md:1